Privacy policy
Last updated 29 September 2026
This policy explains what Studio Radixs does with personal data when you use Kreativ: the dashboard where you manage your archive, and the website we publish for you.
It covers two different groups of people, and the distinction matters throughout. You, the artist, are our customer. The visitors to your published site, and the people on your mailing list, are yours — for their data you are the controller and we act on your instructions.
Who we are
Kreativ is a product of Studio Radixs, Van Hogendorpstraat 54 F, 1051 BR Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 93530552.
Studio Radixs is the controller for the personal data described here.
For questions about this policy or about your data, write to privacy@kreativ.app.
What we collect
We collect what the product needs to work, and we ask for it either because you type it in or because using the service produces it.
- Account details: your name, email address and password. The password is stored only as a hash by our authentication provider; we never see it.
- Your content: works, images, video, series, exhibitions, press, publications, your CV, the pages of your site and its design.
- Your audience: the contacts and mailing list you build, the campaigns you send, and whether a campaign was delivered, opened or clicked.
- Enquiries and contact messages that visitors send through your site, including the sender's name, email address and message.
- Technical data needed to run the service: your IP address and browser when you sign in, and error reports when something breaks.
- Cookieless usage statistics for our own pages: page views and referrers, with no cookie and no profile.
Why we process it, and on what basis
Under the GDPR every processing activity needs a lawful basis. Ours are:
- Performance of a contract: running your account, storing your content and publishing your website. Without this we cannot deliver the service you signed up for.
- Legitimate interests: keeping the service secure, diagnosing errors, preventing abuse, and understanding in aggregate how our own marketing pages are used. We use cookieless analytics specifically so this stays proportionate.
- Legal obligation: retaining invoices and other records the law requires us to keep.
- Consent: where we ask for it explicitly, such as an optional opt-in on a contact form. Consent can be withdrawn at any time.
Your site visitors and mailing list
When someone enquires about a work, sends a message through your contact form or subscribes to your list, that data is yours. You decide what it is used for; we store and transmit it on your behalf as your processor.
This means you are responsible for having a lawful basis to email the people on your list, for honouring unsubscribes, and for answering their requests about their data. We build the tools — every campaign carries an unsubscribe link — but the obligation is yours.
Where your data is stored
We host in the European Union by preference. Where a processor operates outside the EU, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.
How long we keep it
| Data | Retention |
|---|---|
| Your account and content | For as long as your account exists. After you request deletion: 30 days, then permanently erased. |
| Enquiries and contact messages | With your account, and deleted along with it. |
| Contacts and mailing list | Until you delete them, or until your account is deleted. |
| Error reports | Up to 90 days, then discarded automatically. |
| Invoices and financial records | Seven years, as Dutch tax law requires. |
Deleting your account
You can delete your account yourself, from Settings → Account in the dashboard. You do not need to ask us and you do not need to explain why.
Your website goes offline immediately. After 30 days your account and everything in it are permanently erased: works, images, video, pages, contacts, mailing list and stored files. During those 30 days you can still cancel, and your site returns exactly as it was. You can also skip the wait and erase everything straight away.
What survives is only what the law requires us to keep, such as invoices, which are retained separately for the statutory period and used for nothing else.
Your rights
Under the GDPR you have the right to access your data, to correct it, to erase it, to restrict or object to its processing, and to receive it in a portable form.
Most of this you can do yourself in the dashboard, which is faster than asking. For anything else, write to privacy@kreativ.app; we answer within one month.
If you believe we are handling your data wrongly, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We would rather you told us first.
Security
Data is encrypted in transit and at rest. Access to production data is limited to those who need it, every table is protected by row-level security so one account cannot read another's, and passwords are stored only as hashes.
No system is perfect. If a breach occurs that is likely to affect your rights, we will notify you and the supervisory authority within the periods the GDPR sets.
Changes to this policy
When we change this policy we update the date at the top. If a change materially affects you, we will tell you by email before it takes effect rather than expecting you to notice.